---
id: CVE-2026-53792
title: "rsync\_before 3.5.0\_contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block…"
summary: "rsync\_before 3.5.0\_contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block…"
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-129
  - CWE-787
published: '2026-08-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:28:37.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53792'
references:
  - url: 'https://github.com/RsyncProject/rsync/releases/tag/v3.5.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00452
epssPercentile: 0.3663
ingestedAt: '2026-09-08T21:11:12.276Z'
---

## Overview

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.